Bank-Impersonation Wire Transfer Request: Which Attack Is It?

Why the Answer Is Correct

The scenario stacks the three hallmarks CompTIA attaches to business email compromise: a trusted external identity (the company's bank domain), a finance function as the target (accounting), and manufactured urgency pushing an outbound wire transfer. As iliecomptia points out, the study guide describes BEC as "BEC= An impersonation attack in which the attacker gains control" — the fraud is the purpose of the attack, not the phishing mechanics that deliver it. Anyio reaches the same conclusion, noting that in BEC "attackers impersonate a trusted entity (e.g., a bank or executive)" to trick victims into performing a financial transaction. Because the requested action is an irrevocable money movement to an attacker-controlled account, SY0-701 labels this BEC (also called email account compromise) rather than a generic phishing category. The learner vote record is unanimous on A, which matches the exam blueprint's treatment of this exact fraud pattern.

Why the Other Options Are Wrong

B. Vishing requires a voice channel — a phone call, voicemail, or VoIP lure — and nothing in the scenario describes spoken contact; the lure arrives as a written payment message. C. Spear phishing describes targeted credential harvesting or malware delivery against a specific group, which is the delivery technique rather than the wire-fraud objective; jennyka76 lists CEO fraud and bank transfer fraud as spear-phishing examples, but the exam blueprint files bank-transfer fraud squarely under BEC. D. Impersonation is genuinely present — an attacker is posing as the bank — but it is the umbrella term covering helpdesk calls, badge cloning, and vendor spoofing alike, so it is the second-best answer rather than the best one. jbmac's observation that a BEC attacker "impersonates a high-level executive, a trusted vendor" shows how the impersonation label gets absorbed once a more specific named attack fits.

Community Comment Notes

The community is effectively unanimous here, with 89 votes on A and no dissent beyond one learner choosing C. iliecomptia anchors the answer in the official study guide wording rather than intuition, which is exactly how this question should be reasoned. Anyio breaks the definition into its parts — impersonated trusted entity plus a financial transaction — and jbmac adds the insider detail of targeting the accounting department. jennyka76's vote for spear phishing is a useful reminder that the categories overlap, but that overlap is precisely why the exam expects the most specific named attack that matches the outcome.